Re: Object Security Problem

Hi Mike

Not entirely sure it applies in your case but an interesting alternative
approach is described in here un der the section SQL VIEWS
:
http://www-03.ibm.com/servers/enable/site/education/wp/13aae/13aae.pdf

A snip of the SQL in the document is:

CREATE VIEW secureDept
(division ,deptname ,lname ,fname ,salary )
AS
(
SELECT division, deptname, lname, fname,
protectsalary(deptno, salary) AS salary
FROM staff a
INNER JOIN org b ON a.deptno = b.deptno
WHERE division IN
(SELECT division FROM org c
INNER JOIN staff d ON c.deptno = d.deptno
WHERE usrprf = SESSION_USER)
)

The SESSION_USER value is the interesting thing - it allows you to create a
generic view where what the user sees is restricted by dynamically using
their user profile as part of the select statement; in effect a kind of
logical authorization rather than the resource security we are used to,
although it is obviously tied to the security implementation through the use
of the user profile specification.

I haven't had a need to even try this yet, but I think it's pretty
interesting (and kinda cool).

Regards
Evan Harris


-----Original Message-----
From: security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]
[mailto:security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]] On Behalf Of Mike
Sent: Thursday, 18 December 2008 4:13 a.m.
To: Security Administration on the AS400 / iSeries
Subject: [Security400] Object Security Problem

We are creating a logical view of data for a user who needs access to only
data for their department. We are using an exit program with a switch user
to lock this person out of the main table. Normally we give this switch user
*READ access to the physical file and *USE access to the logical. This is
the first logical with a select in it. Do they need more access to the
physical file for a select? If so, what do they need?

-- 
Mike Wills

_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.